Another reason not to change IdP hostnames

[Eric Goodman]

> What's the markup? I know my mobile browsers tend to prompt me, but I
> probably don't have that markup.

I assume this is the autocomplete=off html tag. And even when honored by the browser (which according to Paul isn't often), plugins like LastPass, 1password, etc. would bypass the flag anyway. I still like to set it, nonetheless.

> I guess there's an upside to forcing 180 day password lifetime.

That was the best argument I ever heard for it. Today the number of uncontrolled devices and kiosks floating around with your auto-saved credentials can probably be out of control.

--- Eric